Rockbox Technical Forums
Rockbox Development => New Ports => Topic started by: Aniseed on March 31, 2007, 12:49:35 AM
-
i have just recieved my new iriver x20 and have decided to try my hand at getting some sort of port started. (seeing as i have about 6 months free i thought why not)
any way i have pulled apart the player but havent managed to get any scans of the PCB's or digital photos but i took down most of the details.
main Chip
make: TeleChip
model: TCC8200
other#: OOXX-YNR-PR
NO57BKM
0652
uses: the brains i guess.
Other Chip
make: Coremagic 0076
modle: CMS4A32LAH-75EE
other#: 0647A KOREA
uses: from what i can gather from its position to the processor and other googled info
its 128 megs of quick access memory
Memory Chip
make: Samsung 652
modle: K9HBG08U1M
other#: PCB0
FEK4941A
uses: the main memory, 4 gigs of it on 1 chip
Other Chip 2
Details: TEA5767
VDHN20
05
DPG6463Y
uses: fm tuner
Other Chip 3
make: Texas Instraments
model: AIC23B
TI 6AW
MC1N
uses: far as i know, Amp and controler for headphones and the speakers on the back of the player
and the microphone to.
post edit: added additonal chip data.
-
Here are some pictures found on internet:
(http://www.iriverfans.com/UploadFiles/2007328183916580.jpg)
(http://www.iriverfans.com/UploadFiles/2007328183916621.jpg)
And also some informations about the Cormagic CMS4A32LAH:
http://www.fidelix.co.kr/semiconductor/product/LowSRAM_128M_02.jsp
-
Main Chip
make: TeleChip
model: TCC8200
other#: OOXX-YNR-PR
NO57BKM
0652
Found this http://www.telechips.com/product/p_028.htm
Some additional info on the main audio chip. From that site i would guess this does all the audio, video, immages and probably themicro sd and usb interface as well.
-
i have just recieved my new iriver x20 and have decided to try my hand at getting some sort of port started...
Hi I'm gonna buy iRiver x20 player... I can help with porting rockbox to it (Have experiences with C++, C, ASM) ... If anybody has already started porting it I'll be glad to contact him. I think the first step is to create wiki page for x20
Other Chip 3
make: Texas Instraments
model: AIC23B TI 6AW MC1N
uses: far as i know, Amp and controler for headphones and the speakers on the back of the
player and the microphone to.
This chip si also the audio codec:
http://focus.ti.com/docs/prod/folders/print/tlv320aic23b.html
If anybody has some info about porting status please contact me
thanks
Trigve
-
... searching the net for useful informations about X20 chips, mainly TCC8200 for hours. And finally i found some on rockbox site (different topic, but there are links for our processor too) :)
here is the link:
http://forums.rockbox.org/index.php?topic=10164.msg109942#msg109942
now we can study...
...and hopefully start to porting
bytesize
-
Hey guys.. ive just found this link where u can download the x20 firmware.. not sure if its the original stuff though.. will have to go through it and figure out how to manually load it to the x20..
http://nyaochi.sakura.ne.jp/iriverupdate/
-
hello! i have an x20 and i've read the tcc8200 section on this site. i downloaded the hash calculator and modified it in c++ to automatically write the hashes into the file. i modified the version of the firmware and applied the hashes, but the player didn't accept the file.
here's the modified code (most of it is taken from this site, i only did the part for file writing):
/***************************************************************************
* __________ __ ___.
* Open \______ \ ____ ____ | | _\_ |__ _______ ___
* Source | _// _ \_/ ___\| |/ /| __ \ / _ \ \/ /
* Jukebox | | ( <_> ) \___| < | \_\ ( <_> > < <
* Firmware |____|_ /\____/ \___ >__|_ \|___ /\____/__/\_ \
* \/ \/ \/ \/ \/
* $Id$
*
* Telechips firmware checksum support for scramble
*
* Copyright (C) 2007 Dave Chapman
*
* Thanks to Hein-Pieter van Braam for his work in identifying the
* CRC algorithm used.
*
* All files in this archive are subject to the GNU General Public License.
* See the file COPYING in the source tree root for full license agreement.
*
* This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
* KIND, either express or implied.
*
****************************************************************************/
#include <unistd.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <stdint.h>
#include <stdlib.h>
#include <iostream>
#include <fstream>
#include <string>
#include <cstdio>
using namespace std;
static uint32_t crctable[256];
/* Simple implementation of a function to reverse the bottom n bits in x */
static uint32_t bitreverse(uint32_t x,int n)
{
int i;
uint32_t mask = 1<<(n-1);
uint32_t res = 0;
for (i=0; i<n; i++)
{
if (x & 1)
res |= mask;
x >>= 1;
mask >>= 1;
}
return res;
}
/* Generate a lookup table for a reverse CRC32 */
static void gentable(uint32_t poly)
{
int i;
uint32_t r;
uint32_t index;
for (index = 0; index < 256; index++)
{
r = bitreverse(index,8) << 24;
for (i=0; i<8; i++)
{
if (r & (1 << 31))
r = (r << 1) ^ poly;
else
r<<=1;
}
crctable[index] = bitreverse(r,32);
}
}
/* Perform a reverse CRC32 */
static uint32_t calc_crc(unsigned char *message, int size)
{
uint32_t crc = 0;
int i;
for (i=0; i < size; i++){
if ((i < 0x10) || (i >= 0x18)) {
crc = crctable[((crc ^ (message[i])) & 0xff)] ^ (crc >> 8);
}
}
return crc;
}
/* Endian-safe functions to read/write a 32-bit little-endian integer */
static uint32_t get_uint32le(unsigned char* p)
{
return p[0] | (p[1] << 8) | (p[2] << 16) | (p[3] << 24);
}
static void put_uint32le(unsigned char* p, uint32_t x)
{
p[0] = x & 0xff;
p[1] = (x >> 8) & 0xff;
p[2] = (x >> 16) & 0xff;
p[3] = (x >> 24) & 0xff;
}
/* A simple checksum - seems to be used by the TCC76x firmwares */
void telechips_encode_sum(unsigned char* buf, int length)
{
uint32_t sum;
int i;
/* Set checksum field to 0 */
put_uint32le(buf + 0x10, 0);
/* Perform a simple sum, treating the file as a series of 32-bit
little-endian integers */
sum = 0;
for (i=0; i < length; i+=4) {
sum += get_uint32le(buf + i);
}
/* Negate the sum - this means that the sum of the whole file
(including this value) will be equal to zero */
sum = -sum;
/* Set the checksum field */
put_uint32le(buf + 0x10, sum);
}
/* Two reverse CRC32 checksums - seems to be used by the TCC77x firmwares */
void telechips_encode_crc(unsigned char* buf, int length)
{
uint32_t crc1,crc2;
/* Generate the CRC table */
gentable(0x8001801BL);
/* Clear the existing CRC values */
put_uint32le(buf+0x10, 0);
put_uint32le(buf+0x18, 0);
/* Write the length */
put_uint32le(buf+0x1c, length);
/* Calculate the first CRC - over the entire file */
crc1 = calc_crc(buf, length);
/* What happens next depends on the filesize */
if (length >= 128*1024)
{
put_uint32le(buf+0x18, crc1);
crc2 = calc_crc(buf, 128*1024);
put_uint32le(buf+0x10, crc2);
} else {
put_uint32le(buf+0x10, crc1);
}
}
int main()
{
FILE *fin,*fout;
fin = fopen("X20.test","rb");
fout = fopen("X20.bak","wb");
unsigned char *F=new unsigned char[3000000];
long i=0;
while (!feof(fin))
{
F[i]=getc(fin);
i++;
}
telechips_encode_crc(F,2626096); //that number is the length of the file in bytes
fwrite(F,1,2626096,fout);
cout<<F;cin.get();
fclose(fin);
return 0;
}
do you know what other means of checking the firmware does the x20 have? i'll scan the pcb of my player, as i've seen in the "how to start porting" section.
EDIT:
I'm F@#ING HAPPY RIGHT NOW! I managed to extract the firmware from the Insignia Updater v.1.105. With little modification and rehasing i managed to flash my X20. I think this is an important step. Here are some photos with the X20 with Insignia firmware.
(http://img294.imageshack.us/img294/7972/dsc08032fu1.jpg)
By keenox (http://profile.imageshack.us/user/keenox), shot with DSC-P150 (http://profile.imageshack.us/camerabuy.php?model=DSC-P150&make=SONY) at 2008-04-25
(http://img213.imageshack.us/img213/363/dsc08029cs2.jpg)
(http://img294.imageshack.us/img294/7259/dsc08033br7.jpg)
LE:played a little with it... menus work fine, images as well. but there's one big problem. no sound... not on speakers, not on heaphones, not even in line output... oh... and i upgraded to insignia 1.200
LLE: switched back to iriver 1.07 firmware, as the insignia was of no use because of the sound problems. i got the taste of it and tempered the iriver firmware a little just to see if it works...
(http://img124.imageshack.us/img124/3098/dsc08035vw9.jpg)
-
hey keenox.. glad to see that theres someone active here again.. could you explain the steps how you got about extracting the firmware and flashing it with the new firmware?
I'm really keen on getting the rockbox to the x20.. i see lots of scope for this player.
-
hey, i downloaded the insignia firmware updater and opened it with hex workshop. i looked for the first and last parts from the iriver firmware and extracted all in between to another file. then i copied the header from the iriver firmware and fixed the end of the file to look the same as the iriver firmware. another way is to download the rom file of the insignia firmware (search with google) and do the same things. it's actually simpler using the rom file because it's very similar to the original x20 firmware. then use the code i pasted in the post above using the desired filenames and the correct filesize in bytes to write the CRC sums so that the player will accept the firmware. then copy the file to the root of the player and disconnect it. it will upgrade the f/w in the normal way and when you will power it on you will have the insignia ui. to turn it back to x20 you have to follow a similar procedure using the original iriver f/w and the header and eof from the insignia rom file.
if you want some more details pm me and we shall chat on irc or yahoo messenger.
IF SOMEONE TRIES THIS I'M NOT RESPONSIBLE FOR ANY DAMAGE TO YOUR PLAYER.
i bricked my player trying to flash it using another player's firmware. now i had it replaced for a new one.
-
There's a wiki page for this port here:
http://www.rockbox.org/twiki/bin/view/Main/IriverX20Port
I pruned some posts in the interest of keeping discussion on topic.
*Oops. :p
-
Hi everyone, I am a owner of an Iriver X20 as well and I think that porting Rockbox to it would bring us a fantastic player! :)
I have some little experience in embedded programming but I definitely would need someone's help in order to give my contribution to such a port.
First of all, is there someone still interested in this project?
-
elnigno, it's a much better idea for you to track down a forum where other X20 owners hang out and ask there if they're interested in helping you port Rockbox for that target.
We who already are involved in Rockbox mostly already have devices that have Rockbox or we're working on getting Rockbox to new devices. Those are then most often not X20s as the situation currently is.
-
hi. here you can find some (maybe) interesting things.
IRiver _firmware_updater-1_0.zip
iriver_firmware_updater-1_50.zip
iriver_firmware_updater-2_6_0.zip
iriver2_setup_full.rar
U20(clix)_Bootcode_FWDN_V4
U20(clix)_Bootcode_SFlash_Loader
IRiver _Siragon_X20_FRE_UM_OK
X20_Bootcode
Siragon_X20_FRE_UM_OK.ZIP
IRiver _X20_bootcode.rar
172mb
http://monitor.net.ru/forum/goto.php?url=http://letitbit.net/download/7629.797d932042aef62ab0c96f5b6/iRiver.rar.html
sorry, but this site is russian. For free download you need to press "БеÑплатно"
Siragon......what is it??
and bootcode.....i hope it will be useful for port rockbox.
-
So I've got two Insignia NS-DV2Gs. One's for parts (cracked screen and low-level formatted flash) and one for using.
Since these two players are nearly identical (able to run the each other's firmware?!) I think there's a little bit more value in this port. Also, these players are getting to be $30 shipped on eBay. Might buy another one for bricking purposes.
I guess first step for me will be to try and boot the thing using tcctool in usb mode. Good place to start is going to be the CowonD2 port since it's fairly mature and running on a Telechips core.
Should we roll the two wiki pages into one or just link to one another?
-
Grabbed the Flash board out of my bricked Insignia NS-DVXG and put it in my working model. Using tcctool on windows I was able to upload several different firmwares. With the erased Flash in it it's now in a very developer-friendly state whereby I can load firmware into RAM via USB boot mode and yet have access to the flash memory. The benefit is that when I turn it off, it has no original firmware to load, and so it starts in USB boot mode without soldering any jumpers. Flash memory still works for loading songs, pictures, etc.
This means I can test all manners of firmware without actually flashing the device. I lucked out when I low-level formatted my DAP it seems. :D
I assume booting the device, then putting the rom file onto the root of the device will cause it to reflash itself. I'd rather not tests this theory since I'd like to continue using USB boot mode without hardware mods.
Using X20S.HEX (MD5: 32c59d8c01f34982ab6d6ef0e42d2163):
It seems that the Siragon X20 firmware works flawlessly with the Insignia hardware. All features are supported, but some strange differences. Namely, the hold button states are reversed (hold is unlock and unlock is hold) and the screen is flipped 180 degrees meaning I have to hold it upside-down while the navigation keys are inverted.
Using X20.hex (MD5: 57b1334a703e483ce5364d257aee6420):
Seems to be the same firmware as the Siragon X20. Everything works as before, recording from radio, screen, buttons, etc. Same screen problem. It was a little bit odd that I was only able to listen to the radio recording from the dedicated audio jack (hadn't tested this with the Siragon firmware. Radio itself worked from both 3.5mm jacks.
Next steps:
I've used disarm to decompile the factory update rom into assembler and I'm commenting anywhere I see loads and stores to the GPIO hardware address space. I need to find a way to show a custom firmware runs without crashing, so I guess my 'hello world' app will consist of blinking the backlight on and off.
Now I just need to learn how to build a Telechips-friendly loader rom. Anyone know of any wiki pages dealing specifically on this topic?
-
Now I just need to learn how to build a Telechips-friendly loader rom. Anyone know of any wiki pages dealing specifically on this topic?
Theres several other telechips ports. Take a look at what their bootloaders.
-
Spent a little more time building others' bootloaders. Need to gather some actual patience and read through everything that gets compiled as per saratoga's recommendation. None of the bootloaders I tried had any visible effect on my screen, so no dumb luck for me I'm afraid. Also, none of the compiled loaders had the CRC header information. I've read the TCC8200 spec sheet fairly throughly, and it claims to do CRC checking during USB boot, so code might be running, or it might be failing the CRC check. Bah! I guess I'll change a string in OF and see if it fails to boot.
Was at the parent's place for dinner a few days ago and managed to get some beautiful scans of the PCB. Added those to the wiki. Also went into Photoshop and layered the images over each other for my benefit. The board is layered so it's not perfect, but it's nice to follow the traces through the board and be able to figure which pins of the CPU run to what.
Other random things... Looking at the PCB, it seems the buttons run into an ADC instead of just GPIO pins. Basing that assumption on the fact that 'menu' and 'up' both connect to a single trace with resistors in series. I'm pretty curious how the jog wheel works.
Also, I wonder if the JTAG pins have been pulled out to the jumpers around the chip (five on bottom of chip, three on top). Four of them have resistors, if they turn out to be 10Kohm, that would match with the four pull-ups in the datasheet. I don't have any JTAG development devices, so I'm not digging into that too deep.
Status Update [April 28, 2010]:
Been hacking the iAudio 7 bootloader's main function as the TCC77X and the TCC8200 are nearly identical except that the peripheral addresses start eight bits shifted over (0x80003000 vs 0x80000300 for the 77X) and there are a few more devices (DMA, 2D accel, more GPIO ports) on the 8200.
LCD back light isn't going to be as easy as I'd hoped. Seems the back light power is always supplied and the brightness is probably controlled within the LCD itself. Instead, I've been trying to set Port A to high and testing leads with my voltmeter. No luck, outputs still appear to be floating. Once I get that running, I may be able to attach my own text screen for debugging, logic voltage permitting.
Also, it seems the USB boot doesn't check the CRCs, my changing strings in the OF didn't affect it at all, booted just fine.
Status Update [May 03, 2010]:
Code is now running via tcctool upload. Backlight can be turned on and off. Unexpectedly thebacklight can be controlled from GPIOB instead of GPIOC. Electrically it can be run from GPIOC, so I'm rather confused. Will dig into it when I'm less tired. Super happy I got code running though :D
For future telechips developers, the TCCBOOT define is actually the switch between dual-boot and single firmware boot. To run your code without original firmware, undefine TCCBOOT.
Status Update [Feb 25, 2012]:
Forked Rockbox main and started re-doing everything.
https://github.com/RandomInsano/